Changes

Changes feed

Show: All | Calagator::Events | Calagator::Sources | Calagator::Venues

Time

Attribute with previous and current values

Change #16745

2012-08-14

21:48:32

destroy Calagator::Event 1250462741 TESTING. Please ignore. I'll delete this in a moment. Roll back

Change #16744

2012-08-14

21:48:28

update Calagator::Event 1250462741 TESTING. Please ignore. I'll delete this in a moment. Roll back

venue_id

202390088

→

202392011

Change #16743

2012-08-14

21:48:18

create Calagator::Event 1250462741 TESTING. Please ignore. I'll delete this in a moment. Roll back

end_time	nil	→	2012-08-14 23:00:00 -0700
id	nil	→	1250462741
start_time	nil	→	2012-08-14 22:00:00 -0700
title	nil	→	TESTING. Please ignore. I'll delete this in a moment.
venue_id	nil	→	202390088

Change #16740

2012-08-14

16:41:15

update Calagator::Event 1250462659 OWASP Chapter Meeting Roll back

description

Double Feature! Kevin Dyer will be discussing his current research related to protocol security. A second talk will also be given by a yet-to-be-named speaker. Stay tuned for details. The Open Web Application Security Project (OWASP) is a 501c3 not-for-profit worldwide charitable organization focused on improving the security of application software. To sign up for future meeting notes and to discuss security topics with local gurus, sign up on the OWASP Portland mailing list: https://lists.owasp.org/mailman/listinfo/owasp-portland Meetings are free and open to the public.

→

Double Feature! For this chapter meeting, we have two protocol-oriented talks at PSU. Basic refreshments will be provided. Kevin P. Dyer presents: What Encryption Leaks and Why Traffic Analysis Countermeasures Fail As more applications become web-based, an increasing amount of client-server interactions are exposed to our networks and vulnerable to Traffic Analysis (TA) attacks. In one form, TA attacks exploit the lengths and timings of packets in a protocol's flow to infer sensitive information about communications. In the context of encrypted HTTP connections, such as HTTP over SSH, this means an adversary can determine which website a user is visiting. In the context of a specific web application, an adversary can determine user input by viewing only a few client-server interactions. Recent advances in the application of Machine Learning tools demonstrate that TA attacks are possible despite industry-standard encryption such as TLS, SSH or IPSec. What is more, even if a protocol uses stronger countermeasures, such as fixed-length per-packet padding, this incurs significant overhead but only provides limited security benefit. These types of security vs. efficiency trade-offs are of immediate concern to security-aware applications such as Tor, and performance-sensitive application features such as Google Search Autocomplete. In this talk, Kevin will address the state-of-the-art TA attacks and proposed countermeasures in the context of network and web application security. Most importantly, he will discuss open problems in this area and why a general-purpose TA countermeasure remains elusive. Timothy D. Morgan presents: HTTPS, Cookies, and Men-in-the-Middle: Why You Shouldn't Allow Marketing Departments to Design Your Security Protocols Login session management in modern web applications is largely dominated by use of HTTP cookies. However, HTTP cookies were never designed for secure applications, which has led to a significant number of protocol security problems. In this talk, Tim will start with a brief background on why HTTP cookies are a poorly-conceived mechanism to begin with, and continue with a discussion of how this impacts security. He will describe several lesser-known cookie-based session management problems that remain wide spread and allow for session hijacking through a variety of clever attacks. <hr>Kevin P. Dyer is a PhD student at Portland State University. His research focuses on building protocols that are resistant to Traffic Analysis attacks. Prior to his academic life, Kevin worked as an engineer on various projects in telecommunications security, web security and network security. Kevin holds an MSc in the Mathematics of Cryptography and Communications from Royal Holloway, University of London, and a BS in Computer Science and Mathematics from Santa Clara University. Timothy D. Morgan is a consultant at Virtual Security Research, LLC (VSR). As an application security specialist and digital forensics researcher, Tim has been taking deep technical dives in security for over a decade. Tim resides in Oregon and works at VSR where he helps to secure his customers' environments through penetration testing, training, and forensics investigations. His past security research has culminated in the release of several responsibly disclosed vulnerabilities in popular software products. Tim also develops and maintains several open source digital forensics tools which implement novel data recovery algorithms. <hr> The Open Web Application Security Project (OWASP) is a 501c3 not-for-profit worldwide charitable organization focused on improving the security of application software. To sign up for future meeting notes and to discuss security topics with local gurus, sign up on the OWASP Portland mailing list: https://lists.owasp.org/mailman/listinfo/owasp-portland Meetings are free and open to the public.

Change #16739

2012-08-14